From: Jan Hudec <bulb@ucw.cz>
To: Maciej Soltysiak <solt@dns.toxicfilms.tv>
Cc: John Bradford <john@grabjohn.com>,
Max Valdez <maxvaldez@yahoo.com>,
linux-kernel@vger.kernel.org
Subject: Re: Undelete files on ext3 ??
Date: Tue, 7 Jan 2003 10:45:47 +0100 [thread overview]
Message-ID: <20030107094547.GG2141@vagabond> (raw)
In-Reply-To: <Pine.LNX.4.44.0301071004550.30728-100000@dns.toxicfilms.tv>
On Tue, Jan 07, 2003 at 10:29:06AM +0100, Maciej Soltysiak wrote:
> > There is no simple way, no.
> What about IDE Taskfile access, it's help says something like it's the
> crown jewel of hard drive forensics.
>
> One question, how ext2/3 deletes files? similarily to fat by renaming the
> first character?
No. By removing the directory entry completely and marking the inode
unused.
By the way, there used to be undelete tool for ext2. It created a list
of deleted inodes with correct stat, but no names, only their inode
numbers. You could then pick the corect inode and give it a name, thus
bringing it back to life. Since ext3 is just ext2 with journal, I guess
it might work. It existed as a standalone tool and integrated to
midnight commander.
-------------------------------------------------------------------------------
Jan 'Bulb' Hudec <bulb@ucw.cz>
next prev parent reply other threads:[~2003-01-07 9:37 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-01-07 3:58 Undelete files on ext3 ?? Max Valdez
2003-01-07 8:59 ` Marco d'Itri
2003-01-07 8:59 ` John Bradford
2003-01-07 9:29 ` Maciej Soltysiak
2003-01-07 9:45 ` Jan Hudec [this message]
2003-01-07 17:38 ` Max Valdez
2003-01-07 17:53 ` Andreas Dilger
2003-01-07 17:57 ` John Bradford
2003-01-07 18:56 ` Andreas Dilger
2003-01-07 18:17 ` Richard B. Johnson
2003-01-07 18:41 ` Virtual WORM device John Bradford
2003-01-07 18:53 ` Andreas Dilger
2003-01-07 18:54 ` John Bradford
2003-01-08 18:24 ` Vishal Verma
2003-01-07 18:45 ` Undelete files on ext3 ?? Jesse Pollard
2003-01-07 18:55 ` Andreas Dilger
2003-01-08 5:01 ` Gerhard Mack
2003-01-08 8:00 ` Jan Hudec
2003-01-08 10:57 ` John Bradford
2003-01-08 21:33 ` Valdis.Kletnieks
2003-01-08 21:47 ` John Bradford
2003-01-08 21:51 ` Randy.Dunlap
2003-01-08 22:06 ` Valdis.Kletnieks
2003-01-08 23:03 ` John Bradford
2003-01-08 23:14 ` John Bradford
2003-01-09 9:42 ` Helge Hafting
2003-01-07 20:58 ` Mike Waychison
2003-01-09 8:27 ` Michael Knigge
[not found] ` <Pine.LNX.3.95.1030107131613.3523A-100000@chaos.analogic.co m>
2003-01-07 23:51 ` Billy Rose
2003-01-07 11:30 ` John Bradford
2003-01-07 11:45 ` Matti Aarnio
2003-01-07 12:39 ` Alan Cox
2003-01-08 20:00 ` Michael Milligan
2003-01-07 9:16 ` David van Hoose
2003-01-07 19:31 ` oford
2003-01-08 11:57 ` Pavel Machek
-- strict thread matches above, loose matches on Subject: below --
2003-01-07 9:58 Alexander Sandler
2003-01-08 10:03 bart
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030107094547.GG2141@vagabond \
--to=bulb@ucw.cz \
--cc=john@grabjohn.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maxvaldez@yahoo.com \
--cc=solt@dns.toxicfilms.tv \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox